Release v2026-08-25

This release introduces major protocol enhancements, key structural refactorings to support multi-vertical expansion, payments security improvements (3DS2) and structured request constraints, independent capability versioning, and grocery vertical readiness.

## 📊 Executive Summary

- **📂 Multi-Vertical Refactoring**: Foundation laid for supporting Food and Lodging verticals alongside Shopping, with polymorphic token binding and vertical-agnostic payment constructs.
- **🛒 Grocery Vertical Readiness**: Introduction of Location Search & Lookup capabilities, deterministic operating hours, fulfillment location context, and fractional quantities with sale-basis pricing steps.
- **🔑 Payments Security & Structured Constraints**: Implementation of vendor-agnostic 3D Secure (3DS2) authentication flows via Actions, response-carried `$requestConstraints` (with path targeting & `anyOf`), and split PAN / Network Token credentials.
- **📅 Payment Terms & Schedules**: Deferred payments, deposits, and installment schedules, along with multi-instrument Split Payments.
- **📦 Capability Versioning & Architecture**: Tightened the core version release contract for UCP and version negotiation strategy while also introducing support for namespace ordering (`map_order`).
- **🤝 Identity & Consent Overhaul**: Modernized UCP’s identity and consent architecture—introducing reverse-DNS consent, delegated IdPs, and canonical profile keys—while launching the loyalty extension for interoperable reward ecosystems.

---

## ✨ New Capabilities & Detailed Changes

### 1. Core Protocol & Infrastructure

- **⚡ Actions Primitive ([#582](https://github.com/Universal-Commerce-Protocol/ucp/pull/582))**: Introduces a horizontal, extension-defined `actions[]` array to Cart, Checkout, and Catalog. Allows businesses to request out-of-band actions (like authentication or form-filling) from the platform.
- **🏷️ Namespace Reservation & Ordering ([#657](https://github.com/Universal-Commerce-Protocol/ucp/pull/657))**: Reserves the `ucp` protocol namespace and adds `map_order` to enforce registry ordering.
- **🔒 Namespace Authority Binding ([#530](https://github.com/Universal-Commerce-Protocol/ucp/pull/530), [#627](https://github.com/Universal-Commerce-Protocol/ucp/pull/627))**: Defines how platforms verify that a business has authority over a reverse-DNS namespace via DNS/host matching.
- **📦 Capability Versioning ([#614](https://github.com/Universal-Commerce-Protocol/ucp/pull/614))**: Clarified and tightened the core version release contract, establishing formal guidelines for date-based capability versioning and forward compatibility across protocol updates.
- **📂 Vertical Refactoring ([#723](https://github.com/Universal-Commerce-Protocol/ucp/pull/723), [#736](https://github.com/Universal-Commerce-Protocol/ucp/pull/736), [#741](https://github.com/Universal-Commerce-Protocol/ucp/pull/741), [#761](https://github.com/Universal-Commerce-Protocol/ucp/pull/761))**: Restructured the repository layout into domain verticals (Shopping, Payment, Common) and centralized common primitives in `common/types/` and refactors payment extensions into `dev.ucp.common.payment.*`.
- **🌐 Polymorphic Token Binding ([#746](https://github.com/Universal-Commerce-Protocol/ucp/pull/746))**: Refactors token binding to be vertical-agnostic and polymorphic across multiple verticals.

### 2. Grocery & Location Capabilities

- **🔍 Location Search + Lookup ([#589](https://github.com/Universal-Commerce-Protocol/ucp/pull/589), [#642](https://github.com/Universal-Commerce-Protocol/ucp/pull/642), [#753](https://github.com/Universal-Commerce-Protocol/ucp/pull/753), [#765](https://github.com/Universal-Commerce-Protocol/ucp/pull/765), [#766](https://github.com/Universal-Commerce-Protocol/ucp/pull/766))**: Adds capability to search for physical store locations and lookup details (address, hours, geocoding) with location context hints and correlation.
- **🕒 Deterministic Operating Hours ([#687](https://github.com/Universal-Commerce-Protocol/ucp/pull/687))**: Standardizes how businesses publish regular and exception hours with timezone handling for pickup locations.
- **🏷️ Explicit Destination Types ([#688](https://github.com/Universal-Commerce-Protocol/ucp/pull/688))**: Requires explicit tagged destination types (`shipping` vs `pickup`) in fulfillment methods to prevent ambiguous union matches.
- **⚖️ Fractional Quantities & Sale-Basis ([#597](https://github.com/Universal-Commerce-Protocol/ucp/pull/597), [#653](https://github.com/Universal-Commerce-Protocol/ucp/pull/653))**: Allows purchasing products in non-integer quantities (e.g., weighted items by kg, lb), defines price/quantity steps, and enforces an integer bound cap.
- **🗺️ Fulfillment Location Context ([#671](https://github.com/Universal-Commerce-Protocol/ucp/pull/671))**: Connects negotiated fulfillment methods directly to specific location contexts across Catalog, Cart, and Checkout.

### 3. Payments & Security

- **🔑 3DS2 Authentication ([#458](https://github.com/Universal-Commerce-Protocol/ucp/pull/458))**: Implements vendor-agnostic 3D Secure (3DS2) support (Device Data Collection and Challenge flows) using the Actions primitive.
- **⚠️ Response-Carried Request Constraints ([#655](https://github.com/Universal-Commerce-Protocol/ucp/pull/655), [#744](https://github.com/Universal-Commerce-Protocol/ucp/pull/744), [#757](https://github.com/Universal-Commerce-Protocol/ucp/pull/757))**: Introduces `$requestConstraints` allowing businesses to return transaction-specific schema validation rules for subsequent requests, including path targeting and `anyOf` constraint evaluation.
- **💳 Instrument Requirements & Credential Splitting ([#424](https://github.com/Universal-Commerce-Protocol/ucp/pull/424))**: Expresses instrument requirements via constraints and splits PAN and Network Token into explicit, distinct credential types.
- **📅 Payment Terms & Schedules ([#602](https://github.com/Universal-Commerce-Protocol/ucp/pull/602), [#603](https://github.com/Universal-Commerce-Protocol/ucp/pull/603))**: Introduces payment schedules (simple and well-defined terms) supporting deferred payments, deposits, and installments at checkout.
- **🥞 Split Payments ([#409](https://github.com/Universal-Commerce-Protocol/ucp/pull/409))**: Adds support for split payments across multiple instruments.

### 4. Identity, Consent & Loyalty

- **🌐 Delegated Identity Providers ([#423](https://github.com/Universal-Commerce-Protocol/ucp/pull/423))**: Standardizes accelerated IdP sign-in flows and delegation mechanisms.
- **🎁 Loyalty Extension ([#340](https://github.com/Universal-Commerce-Protocol/ucp/pull/340))**: Formalizes the Loyalty capability across Catalog, Cart, and Checkout, transitioning from legacy discount-based workarounds.
- **🤖 Web Bot Auth (WBA) Interop ([#483](https://github.com/Universal-Commerce-Protocol/ucp/pull/483))**: Introduces WBA interop to allow automated agentic auth negotiation.
- **🔐 Canonical Profile Keys ([#566](https://github.com/Universal-Commerce-Protocol/ucp/pull/566))**: Promotes `keys[]` (JWK Set) as the sole canonical signing key field.
- **🛡️ Extensible Buyer Consent ([#451](https://github.com/Universal-Commerce-Protocol/ucp/pull/451))**: Restructures buyer consent from fixed booleans into a dynamic, reverse-DNS keyed map supporting granular, per-segment opt-in purposes.

### 5. Shopping Enhancements & Fixes

- **📣 Attribution ([#391](https://github.com/Universal-Commerce-Protocol/ucp/pull/391))**: Adds support for platform-driven referral and ad attribution context.
- **📄 Policies ([#572](https://github.com/Universal-Commerce-Protocol/ucp/pull/572))**: Adds a `policies[]` snapshot to Cart, Checkout, Catalog, and Order to carry return, refund, and warranty terms.
- **🔗 Shopping Permalink ([#523](https://github.com/Universal-Commerce-Protocol/ucp/pull/523))**: Adds permalink capabilities to recreate cart states via URL (useful for email/QR codes).
- **🛠️ Cart ID Fix ([#633](https://github.com/Universal-Commerce-Protocol/ucp/pull/633), [#646](https://github.com/Universal-Commerce-Protocol/ucp/pull/646))**: Standardizes `cart.id` as omitted in update requests to simplify client implementations.
- **🏷️ Discount Allocation Totals Path Fix ([#558](https://github.com/Universal-Commerce-Protocol/ucp/pull/558))**: Corrects totals path in discount allocation documentation examples.

---

## 🚨 Breaking Changes

The following changes are backward-incompatible and require schema updates:

- **Fulfillment Schema Restructure ([#507](https://github.com/Universal-Commerce-Protocol/ucp/pull/507), [#581](https://github.com/Universal-Commerce-Protocol/ucp/pull/581), [#763](https://github.com/Universal-Commerce-Protocol/ucp/pull/763))**
  - **Configuration Flags**: Renamed flags to drop the `allows_` prefix (`multi_destination`, `method_combinations`).
  - **Fulfillment Option**: Upgraded `fulfillment_option.description` from a flat string to a structured `description` object.
  - **Multi-Destination**: Remodeled `multi_destination` configuration from a map to an array of objects.
  - **Method Types**: Opened `fulfillment_available_method.type` enum to `string`.
  - **Merchant Consolidation**: Consolidated merchant configurations into `business_fulfillment_config.json` and deleted `merchant_fulfillment_config.json`.
- **Buyer Consent Overhaul ([#451](https://github.com/Universal-Commerce-Protocol/ucp/pull/451))**
  - **Dynamic Map**: Restructured `consent` in `buyer_consent.json` from fixed boolean fields to a dynamic map keyed by reverse-DNS identifiers (`dev.ucp.consent.*`), returning complex `consent_purpose` objects with granular segment-level opt-ins.
- **Profile Keys Promotion ([#566](https://github.com/Universal-Commerce-Protocol/ucp/pull/566))**
  - **Canonical Signing Keys**: Removed `signing_keys[]` from `profile.json` and promoted `keys[]` (JWK Set) as the sole canonical signing key field to eliminate sync drift.
- **Common Types & Vertical Refactoring ([#436](https://github.com/Universal-Commerce-Protocol/ucp/pull/436), [#723](https://github.com/Universal-Commerce-Protocol/ucp/pull/723), [#736](https://github.com/Universal-Commerce-Protocol/ucp/pull/736))**
  - **Hierarchy Restructure**: Reorganized specification hierarchy into domain verticals (`shopping/`, `payment/`, `common/`).
  - **Primitive Schemas**: Moved shared primitive schemas under `common/types/` (`amount.json`, `price.json`, `line_item.json`), changing their `$id` URLs.
- **Payment Constructs & Extension Namespace Migration ([#741](https://github.com/Universal-Commerce-Protocol/ucp/pull/741))**
  - **Extension Namespacing**: Migrated payment extensions from `dev.ucp.shopping.*` to `dev.ucp.common.payment.*` (`split_payments`, `payment_terms`, `ap2_mandates`).
  - **Schema Relocation**: Relocated payment constructs to `common/types/payment.json` as a vertical-agnostic capability.
- **Vertical Agnostic Token Binding ([#746](https://github.com/Universal-Commerce-Protocol/ucp/pull/746))**
  - Refactored token binding to be vertical agnostic and reusable across Retail, Food, Lodging and future verticals.
- **Structured Request Constraints & Instrument Credentials ([#424](https://github.com/Universal-Commerce-Protocol/ucp/pull/424), [#655](https://github.com/Universal-Commerce-Protocol/ucp/pull/655), [#744](https://github.com/Universal-Commerce-Protocol/ucp/pull/744), [#757](https://github.com/Universal-Commerce-Protocol/ucp/pull/757))**
  - **Dynamic Validation**: Replaced static instrument requirement schemas with response-carried `$requestConstraints` supporting JSONPath targeting and `anyOf` constraints.
  - **Credential Splitting**: Split PAN and Network Token into explicit, distinct credential types.
- **Location Search + Lookup & Operating Hours ([#589](https://github.com/Universal-Commerce-Protocol/ucp/pull/589), [#687](https://github.com/Universal-Commerce-Protocol/ucp/pull/687), [#688](https://github.com/Universal-Commerce-Protocol/ucp/pull/688), [#753](https://github.com/Universal-Commerce-Protocol/ucp/pull/753))**
  - **Standardized Location**: Replaced `retail_location.json` with `common/types/location.json`.
  - **Explicit Destination Types**: Disambiguated fulfillment methods with explicit destination types (`shipping` vs `pickup`).
  - **Operating Hours**: Defined deterministic regular and exception operating hours with timezone precision.
- **Fractional Quantities & Sale-Basis ([#597](https://github.com/Universal-Commerce-Protocol/ucp/pull/597), [#653](https://github.com/Universal-Commerce-Protocol/ucp/pull/653))**
  - **Quantity Type**: Upgraded Cart/Checkout `quantity` from strict integer to `anyOf` integer or structured `measure.json` object.
  - **Sale-Basis Pricing**: Defined transactional sale-basis steps for fractional units.
  - **Integer Range Bounds**: Enforced integer range bounds capped at $\pm(2^{53} - 1)$ with maximum `scale: 15`.
- **Cart ID Omission & Transition Cleanup ([#633](https://github.com/Universal-Commerce-Protocol/ucp/pull/633), [#763](https://github.com/Universal-Commerce-Protocol/ucp/pull/763), [#639](https://github.com/Universal-Commerce-Protocol/ucp/pull/639))**
  - **Cart ID Omission**: Standardized `cart.id` as omitted in update requests instead of required.
  - **Orphaned Schemas**: Deleted orphaned `account_info.json` and cleaned up deprecated test scaffolds.
- **Identity Linking OAuth 2.0 Foundation ([#354](https://github.com/Universal-Commerce-Protocol/ucp/pull/354))**
  - **Capability Scopes**: Introduced capability-driven OAuth 2.0 scopes for account linking.

**Full Changelog**: https://github.com/Universal-Commerce-Protocol/ucp/compare/release/2026-04-08...v2026-08-25